IBM i Navigator CVE-2026-93744

Requires network reachability to the IBM i Navigator (Navigator for i) web application HTTP service; the attacker sends a crafted request to any Navigator URL before authenticating, exploiting improper access control to modify server-side session security state. No authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so default-exposed Navigator interfaces are at risk. The principal limiting factor is exposure: the Navigator management interface must be network-accessible to the attacker (e.g., not firewalled to administrative networks), and impact is confined to session security-state alteration (C:L/I:L) rather than full account takeover or code execution.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which raises exposure concern - the flaw is reachable pre-authentication against the Navigator web interface. However, impact is bounded: scope is unchanged (S:U) and the confidentiality/integrity impacts are both Low (C:L/I:L) with no availability impact (A:N), yielding a Medium 6.5 score rather than Critical. The practical effect is limited to altering server-side session security state rather than full authentication bypass with code execution or data exfiltration. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent widespread exploitation. The signals are internally consistent - there is no CVSS-versus-description conflict - but exploitation probability data (EPSS) is entirely absent, so real-world weaponization likelihood cannot be quantified from the input. Treat this as a legitimate patch-in-cycle item for IBM i operators exposing Navigator, not an emergency, absent new exploitation intelligence.

An unauthenticated attacker with network access to an IBM i Navigator endpoint sends a specially crafted HTTP request to any Navigator URL before logging in, manipulating the server-side session security state to weaken or bypass access-control restrictions. Because no credentials, user interaction, or special timing are required (AV:N/AC:L/PR:N/UI:N), the request can be issued directly against an exposed management interface. No public exploit code is identified in the provided data.